From 9a7ed62e2797f434c626b7fe554a1dcae41ab220 Mon Sep 17 00:00:00 2001
From: James Allenby <JamesAllenby@protonmail.com>
Date: Wed, 1 Jul 2026 20:41:50 +0100
Subject: [PATCH] feat: add ReferenceGrants for cross-namespace routing

---
 apps/traefik.yaml               |  3 ++-
 manifests/reference-grants.yaml | 27 +++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 manifests/reference-grants.yaml

diff --git a/apps/traefik.yaml b/apps/traefik.yaml
index 938fa99..9b8bf21 100644
--- a/apps/traefik.yaml
+++ b/apps/traefik.yaml
@@ -15,7 +15,8 @@ spec:
           kubernetesGateway:
             enabled: true
           kubernetesCRD:
-            enabled: false
+            enabled: true
+            allowCrossNamespace: true
           kubernetesIngress:
             enabled: false
         gateway:
diff --git a/manifests/reference-grants.yaml b/manifests/reference-grants.yaml
new file mode 100644
index 0000000..5db51de
--- /dev/null
+++ b/manifests/reference-grants.yaml
@@ -0,0 +1,27 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-traefik-gateway
+  namespace: longhorn-system
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: longhorn-system
+  to:
+    - group: ""
+      kind: Service
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-traefik-gateway
+  namespace: kube-system
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: kube-system
+  to:
+    - group: ""
+      kind: Service